Fix QWingedEdge memory usage issue

QWingedEdge should reserve the amount of segments/edges/vertices in
relative to the element count instead of length of the QPainterPath
passed in. This problem is especially severe when QTextLayout using
it to calculate the region for full line selection highlighting,
because the region used QFIXED_MAX as right most coordinate, it will
cost more than 2 GB of memory allocated just for it (recorded by
valgrind on Mac OS X), and cause crash in systems short of memory.

Task-number: QTBUG-15823
Reviewed-by: Samuel Rødal

1 files changed, 7 insertions, 7 deletions

diff --git a/src/gui/painting/qpathclipper.cpp b/src/gui/painting/qpathclipper.cpp
index a17b7c1..5060ad6 100644
--- a/src/gui/painting/qpathclipper.cpp
+++ b/src/gui/painting/qpathclipper.cpp
@@ -868,9 +868,9 @@ QWingedEdge::QWingedEdge() :
 }
 
 QWingedEdge::QWingedEdge(const QPainterPath &subject, const QPainterPath &clip) :
-    m_edges(subject.length()),
-    m_vertices(subject.length()),
-    m_segments(subject.length())
+    m_edges(subject.elementCount()),
+    m_vertices(subject.elementCount()),
+    m_segments(subject.elementCount())
 {
     m_segments.setPath(subject);
     m_segments.addPath(clip);
@@ -1405,9 +1405,9 @@ bool QPathClipper::intersect()
     else if (clipIsRect)
         return subjectPath.intersects(r2);
 
-    QPathSegments a(subjectPath.length());
+    QPathSegments a(subjectPath.elementCount());
     a.setPath(subjectPath);
-    QPathSegments b(clipPath.length());
+    QPathSegments b(clipPath.elementCount());
     b.setPath(clipPath);
 
     QIntersectionFinder finder;
@@ -1450,9 +1450,9 @@ bool QPathClipper::contains()
     if (clipIsRect)
         return subjectPath.contains(r2);
 
-    QPathSegments a(subjectPath.length());
+    QPathSegments a(subjectPath.elementCount());
     a.setPath(subjectPath);
-    QPathSegments b(clipPath.length());
+    QPathSegments b(clipPath.elementCount());
     b.setPath(clipPath);
 
     QIntersectionFinder finder;